2165 matches found
EUVD-2026-65209
Grav: Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion...
GHSA-JQ29-C7V8-RG55 Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...
EUVD-2026-65211
Grav: mediadirectory Twig function allows filesystem path traversal and file content disclosure from sandboxed page content...
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...
GHSA-47CH-6W46-6XM7 Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...
EUVD-2026-65219
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashedpassword and 2FA secrets via offsetGet...
GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...
EUVD-2026-65220
Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...
GHSA-XJW5-Q542-3VMR Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...
EUVD-2026-65212
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by configdeniedpaths...
GHSA-P597-CRQC-M349 Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...
EUVD-2026-65215
Grav: Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection...
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...
GHSA-38P6-H87P-R4CG Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Summary Grav\Common\Uri::referrer and Grav\Common\Page\Pages::referrerRoute both check whether an incoming request's Referer header "came from our site" using strstartswith$referrer, $base, where $base is the site's own absolute root URL for example https://example.com, no trailing slash. Because...